Introduction To ICT Security Audit OWASP Day Malaysia 2011
1 like2,344 views
This document outlines an agenda for an IT audit and assessment event. It discusses identifying risks like outdated patches, weak passwords, open ports, and phishing. It provides resources for monitoring vulnerabilities and cracking passwords. Labs are suggested to practice tasks like patching, password cracking, port scanning, and network monitoring. The objective is to harden systems against common threats by finding vulnerabilities and ensuring regular security reviews are performed. Participants are encouraged to get involved to improve the security of their organization.
Introduction To ICT Security Audit OWASP Day Malaysia 2011
- 1. Introduction IT Audit & Assessment 20 Sept 2011 OWASP Day Malaysia 2011 https://www.owasp.org/index.php/OWASP_Day_KL_2011
- 2. Agenda ● Objective of The Day ● Identified The Risks ● Who should be involved ● Where To Starts ● What To Audit ● When To Audit ● How To Do It
- 3. Objective • Harden Our Servers • In Depth Defense • Find the loophole • Find the zero day
- 4. Risk Only one risk – Human To Err Is Human
- 5. Its our job to find it. :-)
- 6. Risks ● Not a latest Patches ● Forget my password ● Allow all, Deny None ● Install everything ● Share anything ● Phishing ● No backup
- 7. Not The Latest Patches ● Be alert – http://www.mycert.org.my/en/ – http://www.securityfocus.com/ – http://packetstormsecurity.org/ – http://gcert.mampu.gov.my/ – http://www.cert.org/certcc.html Internet Storm Center – http://isc.sans.edu/ Patches Priority One – http://www.sans.org/top-cyber-security-risks/
- 8. Lab One ● Subscribe websites to Google Reader ● http://www.kb.cert.org/vuls/
- 9. Forget My Password ● We will use easy password ● Password must = Senang nak ingat, susah nak teka. ● Don't leak the hash ● Generate MD5 hash – http://md5crack.com/crackmd5.php ● Crack MD5 – http://isc.sans.edu/tools/reversehash.html
- 10. Lab Two ● Crack this – password – abc123 – haris – Your own name – Birthday date in numbers – Birthday date in any format
- 11. Allow All Deny None ● Any ports outbound open ● Not proxy between LAN and Internet ● Used by BOT to attack and comm with BOSS
- 12. Lab Three ● Telnet – Telnet in CMD and Shell – Port 80 GET /index.htm HTTP/1.1 and enter twice – Port 25 helo and quit ● Visit this website – http://www.yougetsignal.com/tools/open-ports/ – http://canyouseeme.org/
- 13. Install Everything ● To many patches ● To many services ● Only select what you want
- 14. Share Everything ● Windows Share permission “every body” – Don't trust your network ● Putting files in web servers – Google BOT nyum-nyum
- 15. Lab Four ● Google own name in PDF files – harisfazillah filetype:pdf ● You own IC numbers (with and without -) – Do this on your own
- 16. Phishing ● The most used tactic to gain password – Email – Phone
- 17. Lab Five ● Track your organisation here – http://www.phishtank.com/ ● You will never know, you are the target. ● Defacement Archive – http://www.zone-h.org/archive
- 18. Break Jom Minum
- 19. Who ? - The Management - ICT - Me Everybody need to be involved
- 20. Lab Six ● CIS Security – The Benchmark – http://www.cisecurity.org/
- 21. Where To Start ● Any servers that have IP address – Public or Internal – Heavy traffic websites and Email ● LAN – Review firewall and proxy log – SMTP activities – IRC bot activities – HTTP and HTTPS requests – Minitor network traffic
- 22. Lab Seven ● Get the bootable CD ● tcpdump ● wireshark ● Any network analysis tools
- 23. When To Do It ● A must every 6 months ● Any security warning
- 24. Contact [email protected] http://green-osstools.blogspot.com/